# US 11,310,246 B2 · Endpoint-assisted inspection of encrypted network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,246 B2 - Document ID: US11310246B2 - Status: Granted - Kind: B2 - Application number: 16/100,361 - Filed: 2018-08-10 - Published: 2020-02-13 - Granted: 2022-04-19 - Earliest claimed: 2018-08-10 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Martin Rehak; David McGrew; Blake Harrell Anderson; Scott William Dunlop - Web page: https://patentgrep.com/patent/US11310246B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session. ## Claims ### Claim 1 A method, comprising: obtaining, by a traffic inspection service executed by an intermediary device and from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity, wherein the keying information a) comprises encryption keys exchanged between the endpoint device and the remote entity and b) is obtained, after the encrypted traffic session is formed, by the monitoring agent using its root-level privileges at the endpoint device to access memory space of the endpoint device; providing, by the traffic inspection service, a notification to the monitoring agent that acknowledges receipt of the keying information; using, by the traffic inspection service, the keying information to decrypt encrypted traffic from the encrypted traffic session; applying, by the traffic inspection service and based on the decrypted traffic comprising a file from the session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine that the decrypted traffic is malicious or against a privacy policy, and blocking, by the traffic inspection service, the encrypted traffic session from delivering the encrypted traffic to the remote entity, wherein the monitoring agent provides the keying information to the traffic inspection service in response to a determination made by the monitoring agent that a process, a process tree, or a file associated with the encrypted traffic session is untrusted or malicious. ### Claim 2 (depends on 1) The method as in claim 1, wherein the encrypted traffic session is a Transport Layer Security (TLS) session. ### Claim 3 (depends on 1) The method as in claim 1, wherein the traffic inspection service is a firewall or intrusion detection system. ### Claim 4 (depends on 1) The method as in claim 1, further comprising: blocking, by the traffic inspection service, all encrypted traffic associated with the endpoint device for which the traffic inspection service did not receive keying information from the monitoring agent. ### Claim 5 A method, comprising: detecting, by a monitoring agent of a device, a handshake between the device and a remote entity to form an encrypted traffic session; capturing, by the monitoring agent, keying information for the session from the handshake, wherein the keying information a) comprises encryption keys exchanged between the device and the remote entity and b) is obtained, after the encrypted traffic session is formed, by the monitoring agent using its root-level privileges at the device; providing, by the monitoring agent, the captured keying information to a traffic inspection service, wherein the traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session and applies a policy to the encrypted traffic session based on the decrypted traffic, wherein application of the policy to the encrypted traffic session comprises blocking the encrypted traffic session based on a determination that the decrypted traffic is malicious or against a privacy policy; and delaying, by the monitoring agent, providing of the encrypted traffic from the device to the remote entity, until the traffic inspection service acknowledges receipt of the provided keying information, wherein the monitoring agent provides the keying information to the traffic inspection service in response to a determination made by the monitoring agent that a process, a process tree, or a file associated with the encrypted traffic session is untrusted or malicious. ### Claim 6 (depends on 5) The method as in claim 5, wherein the encrypted traffic session is a Transport Layer Security (TLS) session. ### Claim 7 (depends on 5) The method as in claim 5, wherein the traffic inspection service is a firewall or intrusion detection system. ### Claim 8 (depends on 5) The method as in claim 5, further comprising: obtaining, by the monitoring agent, an acknowledgement from the traffic inspection service that acknowledges receipt of the keying information. ### Claim 9 (depends on 5) The method as in claim 5, wherein capturing the keying information for the session from the handshake comprises: capturing, by the monitoring agent, the keying information from a memory space of a process of the device that is associated with the handshake. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: obtain, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity, wherein the keying information a) comprises encryption keys exchanged between the endpoint device and the remote entity and b) is obtained, after the encrypted traffic session is formed, by the monitoring agent using its root-level privileges at the endpoint device to access memory space of the endpoint device; provide a notification to the monitoring agent that acknowledges receipt of the keying information; use the keying information to decrypt encrypted traffic comprising a file from the encrypted traffic session; apply, based on the decrypted traffic comprising a file from the session, a policy to the encrypted traffic session between the endpoint device and the remote entity to determine that the decrypted traffic is malicious or against a privacy policy; and block the encrypted traffic session from delivering the encrypted traffic to the remote entity, wherein the monitoring agent provides the keying information to the apparatus in response to a determination made by the monitoring agent that a process, a process tree, or a file associated with the encrypted traffic session is untrusted or malicious. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the encrypted traffic session is a Transport Layer Security (TLS) session. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the apparatus comprises a firewall or intrusion detection system. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the monitoring agent delays providing traffic of the encrypted traffic session until the endpoint device obtains the notification that acknowledges receipt of the keying information. ### Claim 14 (depends on 10) The apparatus as in claim 10, wherein the apparatus is located at an edge of a local network that includes the endpoint device.